public/manifest.json declares share_target (POST multipart to
/share-target: title/text/url + image/video/audio/pdf/text files). The
service worker answers that POST itself: it stashes the form in a Cache
API bucket and 303s to the in-app /share page, which lists what arrived,
offers a room search, and on pick writes the files into that room's
upload-board atom (encrypting first for E2EE rooms via the composer's
shared filesToUploadItems) and the title/text/url into its draft, then
opens the room — the user still presses Send. The stash is cleared once
placed; reopening /share afterwards says so.
nginx/caddy examples and the prod image config gain a 303 for
/share-target so a POST that reaches the origin before the worker
controls the page lands on /share instead of a 405. iOS has no share
target support and ignores the manifest entry.
Verified headless against the built preview: SW-controlled page → POST
/share-target (two PNGs + title + text) → /share lists both files and the
text → pick the DM → composer shows both files on the upload board and
the text in the draft → /share reports nothing pending.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01PPmy3tPq869XDW4njjVaKA
Brings the 4.12.7 fixes: "%" sign wrapping below the composer input and
emoji autocompletion overwriting the preceding element. The release's
security half (sanitize-html, react-router-dom) was already applied in
91def3ad (we are on newer versions than upstream ships).
Resolved: kept our package.json/lockfile (the fork is ahead on every
dependency — React 19, router 7, i18next 26…), version 4.12.7-lotus, our
README/CONTRIBUTING, our "Lotus Chat vN" branding via pkg.version, and
the deleted GitHub-only workflows stay deleted. Note upstream announces
it is replacing matrix-js-sdk with its own SDK and pausing PRs; future
syncs will get harder.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01PPmy3tPq869XDW4njjVaKA
Add HSTS + Permissions-Policy + the standard X-Frame/X-Content/Referrer set to
the contrib nginx (443 block) and caddy examples; fix the caddy SPA try_files
fallback (stray space). Generic (no homeserver-specific CSP). The real prod
config lives in the matrix repo. P6-4 trimmed to headers only — patch-package /
types-drift / build-config skipped (see LOTUS_TODO).
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
* chore: Bump matrix-js-sdk to 34.4.0
* feat: Authenticated media support
* chore: Use Vite PWA for service worker support
* fix: Fix Vite PWA SW entry point
Forget this. :P
* fix: Also add Nginx rewrite for sw.js
* fix: Correct Nginx rewrite
* fix: Add Netlify redirect for sw.js
Otherwise the generic SPA rewrite to index.html would take effect, breaking Service Worker.
* fix: Account for subpath when regisering service worker
* chore: Correct types
* chore: Bump matrix-js-sdk to 34.4.0
* feat: Authenticated media support
* chore: Use Vite PWA for service worker support
* fix: Fix Vite PWA SW entry point
Forget this. :P
* fix: Also add Nginx rewrite for sw.js
* fix: Correct Nginx rewrite
* fix: Add Netlify redirect for sw.js
Otherwise the generic SPA rewrite to index.html would take effect, breaking Service Worker.
* fix: Account for subpath when regisering service worker
* chore: Correct types
jaredandClaude Opus 5
Ajay Bura
sophie
Lain Iwakura
夜坂雅
creme